REIMBURSEMENT PAGE
By DEVON BERNARD
E! QUIZ M EARN
2
BUSINESS CE
CREDITS P.20
Staying Social—and Compliant Tips for crafting a social media consent form for patients—and retaining HIPAA compliance
Editor’s Note—Readers of Reimbursement Page are eligible to earn two CE credits. After reading this column, simply scan the QR code or use the link on page 20 to take the Reimbursement Page quiz. Receive a score of at least 80%, and AOPA will transmit the information to the certifying boards.
T
HE SECURITY AND PRIVACY
provisions within the Health Insurance Portability and Accountability Act (HIPAA) were written and enacted long before social media sites like Facebook, Twitter, Instagram, and TikTok became popular. These social media venues have become valuable tools for reaching out to and educating patients, and for marketing your business. However, the HIPAA security and privacy rules remain relevant and must be followed; there are multiple potential areas of risk for violating the HIPAA rules and breaching a patient’s privacy on social media platforms. How can your facility use social media without running the risk of violating HIPAA rules? This month’s Reimbursement Page examines some of the common mistakes associated with social media and HIPAA and offers tips for ensuring compliance.
16
JUNE/JULY 2022 | O&P ALMANAC
Personal Health Information
When using social media platforms, or when dealing with HIPAA in general, it is never acceptable to disclose or share protected health information (PHI) outside of your normal business operations for treatment or payment. PHI is any information about a patient or the patient’s care, and any details that could expose or identify the patient’s identity. This goes beyond photographs, birthdates, health ID numbers, or telephone numbers; it also includes things like the patient’s email address or their Instagram account name. PHI may only be included in your company’s social media posts if a patient has given their permission, in writing, to allow their PHI to be used—and then only for the purpose specifically referred to on the consent form.
Common HIPAA Violations on Social Media
Some of the more common mistakes, violations, breaches, or issues that can arise with social media and HIPAA are listed below. Remember that a breach or violation is any impermissible use or disclosure of information that compromises the security or privacy of the PHI and, ultimately, the patient. • Sharing pictures and videos of patients without their express written consent or authorization. It is never acceptable to directly share information about your
patients outside of normal business operations, unless you have the patient’s permission. • Referring to unconfirmed news about patients, or sharing gossip about patients. • Inadvertently or accidently showing patients’ pictures or patients’ PHI. This would include posting a picture of your office where, in the background, you can see a patient or a patient chart. • Posting or sharing information to sites or groups that you thought were private. Just because a group is marked as “private” doesn’t mean that the information will not be shared with others. If you would not share it or post it in an open forum or on a public platform, then you should not share it in private. In addition, on some sites, even if they are “private,” the messages may not be encrypted and secured. Along the same lines, don’t assume that just because a post or photo has been deleted, it is no longer visible to the public.
Social Media Policy
To facilitate compliance with HIPAA and avoid potential fines, there are a few steps you can take when using social media. Most importantly, create or review your social media policy. While your policy should be tailored to fit your company’s needs, following some general rules will help protect your employees and your facility.
